Update spire-identity-exchange for 0.4.0 (#900)
* Update spire-identity-exchange for 0.4.0 Signed-off-by: Kevin Fox <[email protected]> * Understand the plugin config Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Update ip Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Fix broken socket path Signed-off-by: Kevin Fox <[email protected]> * Nope, it was right before Signed-off-by: Kevin Fox <[email protected]> * Try disabling the spiffe plugin for now Signed-off-by: Kevin Fox <[email protected]> * Try logging more Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Add missing csi driver settings Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Use local oidc discovery provider path by default Signed-off-by: Kevin Fox <[email protected]> * Enable spire-identity-exchange in shared infrastructure Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump spire-ha-agent version to fix issue Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Update version bits to match what it should be, minus final bump Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,64 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-nested.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-nested.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-nested.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-nested.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-nested.chart" . }}
|
||||
app.kubernetes.io/name: {{ include "spire-nested.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
The namespace the SPIRE server side components land in. Resolved the same way as
|
||||
spire-identity-exchange.namespace, so the combined exposure lands beside the exchange
|
||||
pods it selects — a Service selector is namespace scoped.
|
||||
*/}}
|
||||
{{- define "spire-nested.server-namespace" -}}
|
||||
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.server.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-server" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Base name for the combined identity exchange objects. Keyed on the release name so it
|
||||
reads like the per-side exchanges, which the sides' own releases name spire-a-identity-
|
||||
exchange / spire-b-identity-exchange — so these never collide with them either.
|
||||
*/}}
|
||||
{{- define "spire-nested.identity-exchange-name" -}}
|
||||
{{- printf "%s-identity-exchange" .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,3 @@
|
||||
{{- if .Values.gatewayAPI.gateway.enabled }}
|
||||
{{- include "spire-lib.gateway-resource" (dict "root" . "gatewayObject" .Values.gatewayAPI.gateway) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.grpc.enabled .Values.spireIdentityExchange.spiffe.grpc.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-grpc-spiffe" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{/* Passthrough only. These backends serve an X509-SVID, whose only SAN is a
|
||||
spiffe:// URI, so a BackendTLSPolicy hostname check could never match. */}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.spiffe.grpc.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.spiffe.grpc.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" "TLSRoute"
|
||||
"backendTLS" false) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.grpc.enabled .Values.spireIdentityExchange.spiffe.grpc.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.spiffe.grpc.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.spiffe.grpc.ingress) }}
|
||||
{{- $fullName := printf "%s-grpc-spiffe" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.spiffe.grpc.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.spiffe.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.spiffe.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.spiffe.grpc.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.grpc.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-grpc-spiffe
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.spiffe.grpc.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.spiffe.grpc.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.spiffe.grpc.service.type "LoadBalancer") .Values.spireIdentityExchange.spiffe.grpc.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.spiffe.grpc.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.spiffe.grpc.service.port }}
|
||||
targetPort: grpc-spiffe
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.rest.enabled .Values.spireIdentityExchange.spiffe.rest.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-rest-spiffe" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{/* Passthrough only. These backends serve an X509-SVID, whose only SAN is a
|
||||
spiffe:// URI, so a BackendTLSPolicy hostname check could never match. */}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.spiffe.rest.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.spiffe.rest.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" "TLSRoute"
|
||||
"backendTLS" false) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.rest.enabled .Values.spireIdentityExchange.spiffe.rest.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.spiffe.rest.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.spiffe.rest.ingress) }}
|
||||
{{- $fullName := printf "%s-rest-spiffe" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.spiffe.rest.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.spiffe.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.spiffe.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.spiffe.rest.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.rest.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-rest-spiffe
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.spiffe.rest.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.spiffe.rest.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.spiffe.rest.service.type "LoadBalancer") .Values.spireIdentityExchange.spiffe.rest.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.spiffe.rest.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.spiffe.rest.service.port }}
|
||||
targetPort: rest-spiffe
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.grpc.enabled .Values.spireIdentityExchange.tls.grpc.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-grpc" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{- $routeKind := include "spire-lib.gateway-route-kind" (dict "gatewayAPI" .Values.spireIdentityExchange.tls.grpc.gatewayAPI) -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.tls.grpc.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.tls.grpc.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" (eq $routeKind "HTTPRoute")) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.grpc.enabled .Values.spireIdentityExchange.tls.grpc.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.tls.grpc.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.tls.grpc.ingress) }}
|
||||
{{- $fullName := printf "%s-grpc" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.tls.grpc.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.tls.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.tls.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.tls.grpc.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.grpc.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-grpc
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.tls.grpc.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.tls.grpc.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.tls.grpc.service.type "LoadBalancer") .Values.spireIdentityExchange.tls.grpc.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.tls.grpc.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.tls.grpc.service.port }}
|
||||
targetPort: grpc
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.rest.enabled .Values.spireIdentityExchange.tls.rest.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-rest" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{- $routeKind := include "spire-lib.gateway-route-kind" (dict "gatewayAPI" .Values.spireIdentityExchange.tls.rest.gatewayAPI) -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.tls.rest.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.tls.rest.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" (eq $routeKind "HTTPRoute")) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.rest.enabled .Values.spireIdentityExchange.tls.rest.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.tls.rest.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.tls.rest.ingress) }}
|
||||
{{- $fullName := printf "%s-rest" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.tls.rest.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.tls.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.tls.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.tls.rest.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.rest.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-rest
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.tls.rest.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.tls.rest.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.tls.rest.service.type "LoadBalancer") .Values.spireIdentityExchange.tls.rest.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.tls.rest.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.tls.rest.service.port }}
|
||||
targetPort: rest
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user